Version 2026-11-01. Effective 1 November 2026.
1. Who we are
1.1. JTL Advisory and Business Solutions Inc. ("JTL", "we", "us") provides Sahora, a payroll, timekeeping and HR service for employers in the Philippines. JTL is a corporation registered with the Securities and Exchange Commission under registration number 2023090169084-05, with its principal office at Unit 3101-C East Tower, Tektite Twin Towers, Exchange Road, Ortigas Center, Pasig City 1600, Philippines. Company website: www.jtladvisory.com.
1.2. We comply with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).
1.3. This notice explains what personal information Sahora handles, why, who sees it, how long it is kept, and your rights.
2. Our two roles
2.1. When JTL decides (controller). JTL is the personal information controller for:
- visits to the Sahora website;
- messages sent through the contact form;
- sign-up requests (the "Get started" form) and the Free Plan checks;
- users' sign-in accounts and security records (sign-in, two-step verification, devices, sign-in attempts);
- billing contacts and billing records of client companies.
2.2. When your employer decides (processor). For the payroll, HR and timekeeping records of employees, your employer is the personal information controller: it decides what is processed and why. JTL processes those records on your employer's behalf and on its instructions, as a personal information processor, under a Data Processing Agreement with your employer. If an accounting firm or our Sahora Managed team runs payroll for your employer, they work under your employer's authority.
2.3. Questions about your payroll records should normally go to your employer. You may also write to our Data Protection Officer (section 16), and we will help your employer respond.
3. Website visitors and our forms
3.1. Website visits. When you open a page of the public website, we record the page, the website you came from (its address only), your browser's identification string (which names the browser and device type), the approximate place (city, province or region, and country, as reported by our hosting provider from your internet address) and a coded value of your internet address (a keyed hash; we do not store the address itself). We do not use cookies to count visits. Visits by our super administrators and from addresses we choose to ignore are not counted.
3.2. Contact form. Your name, work email, company (optional), number of employees (optional), the topic and your message. The message is emailed to our team (until our sahora.ph mailboxes are set up, to the work accounts of JTL's administrators of Sahora) and you receive a short automatic reply. A copy of both emails is kept with Sahora's sent emails for 12 months. Nothing else from the form is stored.
3.3. Sign-up request ("Get started"). The company's name and type, your name, email and mobile number, the number of employees, the plan you want, whether you want Sahora Managed, your message, the company's registration type and number and TIN (optional), the date and time, the version of this notice you acknowledged, and a coded value of your network (a keyed hash of your internet address, or of its network range for newer IPv6 addresses; never the address itself).
3.4. Free Plan checks. To keep to one Free Plan per person and per business, a Free Plan sign-up is compared automatically with existing Free Plan accounts (email, mobile number, company name, registration number and TIN) and with the coded network values of earlier sign-ups and of Free Plan owners' sign-ins. If it matches, the sign-up may be refused automatically. You can ask for a person to review the decision by writing to support@sahora.ph.
3.5. Bot check. Both forms use Cloudflare Turnstile to check that a person, not a program, is sending them. Your browser sends Cloudflare technical signals for this (such as your internet address and browser details), and our server sends Cloudflare your internet address with the check. Cloudflare does this for us, and also uses the signals to improve Turnstile under its own privacy policy. We receive only a pass or fail answer.
4. Account users
4.1. Account details: name, email address, role or roles, the companies or firm you can access, your language choice, and your notification email settings.
4.2. Security records: sign-in and two-step verification records; for each place you are signed in, the browser or app, its approximate place (city and province, from our hosting provider) and when it was last used; and the acknowledgment of this notice with its version. You can see your devices under Devices and sign any of them out. The device list does not show your internet address. Our sign-in provider (Supabase) keeps the internet address with each session and sign-in event in its own security logs.
4.3. Sign-in attempts: the email used and a coded value of the internet address, to stop password guessing. Deleted after 90 days.
4.4. Activity log: each change a user makes in a company's records (who, what, when, and the values before and after). Encrypted numbers stay encrypted in the log. Views of full government or bank numbers, views of clock-in photos, and downloads of files with full numbers are also logged. Ordinary viewing of other records is not logged.
5. What employers keep about employees
Your employer (or an accounting firm or our Sahora Managed team, for your employer) may enter or collect:
5.1. Employee records: name, birth date, sex, civil status, nationality, address and zip code, contact details, position, department, branch, employment dates and status, separation date and reason, salary and pay basis, allowances, bonuses and other pay items, loans and deductions, and earlier pay in the year (such as a previous employer's BIR Form 2316).
5.2. Government and bank numbers: TIN, SSS, PhilHealth and Pag-IBIG numbers, and bank account details. These are encrypted (section 10).
5.3. Payroll results: payroll runs, payslips, year-to-date figures, 13th month pay, final pay, BIR Form 2316 and the alphalist, and government contribution reports.
5.4. Documents and signatures: copies of IDs and other files in the employee's 201 file; loan and cash advance authorizations you sign on screen; and your signature on BIR Form 2316 if your employer uses that (a scan of the paper copy you signed, or a signature drawn on screen). With each signature and with your onboarding confirmation, Sahora keeps the time and a coded reference of the network you used (never the address itself).
5.5. Requests and messages you file: leave (dates and reason), overtime, official business, time corrections, expense claims with photos or copies of receipts, changes to your profile, onboarding details and ID copies, questions about a payslip and the answers, and who approved or answered each.
5.6. Benefits that may involve health information: for example, maternity benefit records and some leave types.
6. Timekeeping (clock-in and clock-out)
6.1. Location. When you clock in or out in the employee portal, your phone is asked for your location at that moment. We record it with the time, its accuracy and the distance from your branch. If you work from home, that is where the location is recorded. Your location is never tracked in between punches. Depending on your employer's settings, a punch without your location, or outside your work area, may be refused; otherwise it is recorded and marked.
6.2. Time. The time recorded is Sahora's own clock. For a clock-in made without a signal (section 6.7), the time your phone recorded is used, within a limit.
6.3. Your phone. Sahora keeps a random id on your phone to recognize it, and records a description of the phone and browser, your phone's own clock time, and coded values (keyed hashes) of the phone and of the internet address it used. A new phone may need HR's approval.
6.4. Selfies and the movement check. If your employer turns on selfies, a photo is taken with your phone's front camera at each punch, through the live camera only. You may be asked to make a small movement (turn your head or smile) to show that it is really you and not a picture. Your phone checks the movement itself; the selfie and a few frames taken during the movement are sent to Sahora and stored with your punch. They are used only to check who clocked in.
6.5. Who sees the photos. You; your supervisor (and anyone standing in for them); your employer's owners, HR, payroll and payroll approver staff, within the branches or departments they handle; an accounting firm or Sahora Managed staff that run payroll for your employer; and JTL's own administrators, only to support or secure Sahora. Each view in Sahora is logged. Photos and frames are deleted after 90 days. A photo of a punch still under review, or of a day with a pending time correction, is kept longer, but never more than 180 days.
6.6. Face matching. Sahora does not compare faces today. Face matching can be used only if your employer turns it on and you agree, in person, after HR shows you a separate notice. HR would then take reference photos of you, and each clock-in photo would be compared with them by a program that Sahora runs itself; the numbers it makes from a face are stored encrypted, and no photo or face data goes to a face-recognition company. If you do not agree, face matching is not used for you.
6.7. Checks on punches, and automated decisions. Sahora checks each punch automatically for signs of a mistake or misuse (for example, a punch far from the branch, a different phone, a photo used before, or times that do not fit). Depending on your employer's settings, a punch may be accepted, flagged for review, held for a person to decide, or rejected automatically; a rejected punch does not count toward your attendance until a person reviews it. You can always ask for a time correction, which a person decides, and you can ask your employer to have a person review any automated decision about your punches.
6.8. Without a signal. If your employer allows it, a clock-in made without a signal waits on your phone and is sent when you are back online, with the time your phone recorded (up to 72 hours earlier).
6.9. Maps. When HR or your supervisor opens the location of a punch on a map, the location is sent to the map service they use (Google Maps or OpenStreetMap).
6.10. Biometric devices. If your employer uses fingerprint or face devices, Sahora receives only the device's log of employee numbers and times, never fingerprints or face data.
7. Sensitive personal information
Some records are sensitive personal information under the Data Privacy Act, such as government-issued numbers (TIN, SSS, PhilHealth, Pag-IBIG), tax records, and health information in some leave and benefit records. They are processed only as the law allows (for example, because the law requires the employer to keep and report them) and are protected as described in section 10.
8. Why we use personal information, and on what basis
| Purpose | Whose information | Basis |
|---|---|---|
| Computing and paying salaries, producing payslips and records, and meeting the employer's legal duties to the BIR, SSS, PhilHealth, Pag-IBIG and DOLE | Employees | The employment contract and the employer's legal obligations (decided by the employer as controller), not consent |
| Timekeeping (location, selfies, the movement check, phone details), leave, overtime, claims and other requests | Employees | The employment contract, the employer's duty to keep time records, and its legitimate interest in accurate attendance and pay, explained in the clock-in notice employees see |
| Face matching, if an employer ever turns it on | Employees who agree | The employee's consent, given in person |
| Asking employees for missing government numbers (your employer may mark a number "not available yet" so payroll can go on, and you are reminded) | Employees | The employer's legal obligations |
| Running and securing Sahora: sign-in, two-step verification, the device list, sign-in lockout, the activity log, and error monitoring | Users | Our legitimate interest in keeping accounts and records secure, and the security duties of the Data Privacy Act |
| Answering contact form messages | Contact form senders | Your request |
| Reviewing sign-up requests and setting up the company | People who sign up | Your request, and the steps before a contract |
| Keeping to one Free Plan per person and per business (section 3.4) | People who sign up; Free Plan owners | Our legitimate interest in preventing misuse of the free service |
| Counting website visits | Visitors | Our legitimate interest in running the website |
| Sending emails about accounts, approvals, payslips (a notice with a link) and billing | Users | The contract, and our legitimate interest |
| Billing statements, payments and tax records of the subscription | Billing contacts of client companies | The contract and our legal obligations (tax records) |
We do not sell personal information and do not use it for advertising or for unrelated marketing.
9. Who sees it
9.1. Inside your employer's workspace, each role sees only what it needs. Payroll approvers see pay figures but only the last four digits of government and bank numbers; team approvers (supervisors) see their own team's requests and attendance; employees see their own records. Full government and bank numbers are shown only to roles that need them (owners, payroll officers, HR administrators and finance staff, and an accounting firm or Sahora Managed staff working for your employer), and each view and each download of them is logged.
9.2. Accounting firms. An accounting firm works in a company's workspace when the company invites it, or when the company signs up through the firm or asks us to place it with one. We place a company with an accounting firm only when the company asks for it or agrees. A firm's administrators can see every company the firm handles; its staff see the companies the firm assigns them. The company can remove the firm at any time.
9.3. JTL's own team. Our super administrators, and the staff of Sahora's own platform team, which handles companies that signed up directly and do not work with an accounting firm, can access records to set up, run, support and secure Sahora. Changes they make, and views of full numbers and clock-in photos, are logged.
9.4. Our Sahora Managed staff, if your employer uses that service, prepare payroll in your employer's workspace. They never approve or release a payroll run.
9.5. Service providers that host and run Sahora (section 11).
9.6. Systems your employer connects. If your employer connects another system to Sahora (the API or webhooks), Sahora sends that system what your employer set up. The API never returns government or bank numbers.
9.7. Government agencies: your employer uses Sahora's reports and forms to file with the BIR, SSS, PhilHealth, Pag-IBIG and DOLE. Sahora does not file for your employer.
9.8. When the law requires, for example a lawful order of a court or a government agency.
10. How it is protected
- Each company's records are kept apart in the database itself (row-level security), and this is tested on every table.
- Employees' government ID numbers (TIN, SSS, PhilHealth, Pag-IBIG) and bank account numbers, and companies' payroll bank account numbers, are encrypted (AES-256-GCM, with versioned keys) and masked by default.
- Everyone who can see payroll or HR records, except employees using their own portal, signs in with two-step verification and is asked to keep two authenticators; resets are logged and the user is told.
- Sessions end after 30 minutes without activity (a setting), also when the browser was closed; repeated wrong passwords lock sign-in for a while; users can sign out their other devices.
- Every change is recorded in an activity log that can only be added to.
- Payslip emails contain a link, never the payslip or any amount. Payslip PDFs are password-protected unless your employer turns this off.
- Off-site backups are encrypted before they leave the backup job (once switched on).
- Error reports have personal data fields removed before they leave Sahora (once switched on).
11. Service providers and where data is kept
11.1. Sahora's records are stored in Singapore (database, sign-in and file storage by Supabase; the application runs on Vercel in Singapore). Some providers process some data elsewhere:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | Singapore (its support staff may work from other countries) |
| Vercel | Application hosting; approximate place of visitors and devices | Singapore (the application); requests pass through Vercel's global network, and Vercel may process service data in the United States |
| Cloudflare (Turnstile) | Bot check on the website forms | Cloudflare's global network |
| Resend (once switched on) | Sending email | Sending region Tokyo, Japan; account data in the United States |
| Sentry (once switched on) | Error monitoring, with personal data fields removed | European Union (some account information in the United States) |
| Cloudflare R2 (once switched on) | Encrypted off-site backups | Asia-Pacific (a location preference, not guaranteed) |
| GitHub Actions (once switched on) | Runs the nightly backup job; the copy is encrypted on the job's machine before upload | Microsoft Azure data centers chosen by GitHub |
| Google Workspace (once live) | Our team mailboxes | Google's data centers |
11.2. The full, current list is on the Subprocessors page (/legal/subprocessors). We update it before adding a provider that processes personal data.
11.3. Storing or processing data outside the Philippines is a transfer abroad. JTL remains responsible for personal information it transfers abroad, as the Data Privacy Act requires, and protects it through each provider's data processing terms and security commitments.
12. How long it is kept
| Record | How long |
|---|---|
| Payroll, tax and contribution records | At least 10 years (the BIR can assess up to 10 years in some cases), or longer if the law or the employer requires; while the company uses Sahora, the company decides beyond that |
| Time and attendance records, including punch locations | At least 3 years, on the same terms |
| The activity log | As long as the payroll records |
| Clock-in selfies and movement-check frames | 90 days, then deleted automatically; up to 180 days if the punch is still under review |
| Face-matching reference photos (only if ever used) | Until the period the employer sets after the employee leaves (30 days unless it chose another) |
| Sign-in attempts | 90 days |
| Website visit records | 13 months |
| Coded network values for Free Plan checks | The period in the price list in force (currently 730 days) |
| Contact form messages and copies of emails Sahora sends | 12 months (emails still waiting to be sent are kept until sent) |
| Sign-up requests | 12 months if not approved; as long as the company's account if approved |
| Billing statements and payment records | At least 10 years, or longer if the tax laws require |
| A Free Plan company archived for inactivity | 12 months archived, then deleted after a further 30 days' notice to its owners, unless reactivated |
| Encrypted backups | Daily copies 35 days; monthly copies 12 months (once switched on) |
13. When a client company leaves Sahora
13.1. The company's owners can download all its data at any time.
13.2. When a company cancels or asks to leave, its workspace becomes read-only and the data stays available to export for a period (currently 90 days). Within 30 days after that period, its records and files are deleted and a certificate of deletion is issued, unless the company has arranged a paid archive.
13.3. Deletion keeps a few records:
- the activity log, which holds the before and after values of records that were changed while the company used Sahora (encrypted numbers stay encrypted), until the end of the payroll records period (section 12); the deletion itself is logged row by row without the deleted values;
- the company's name and its subscription record (which holds the certificate);
- the billing statements, payments and billing settings, which the tax laws require;
- the sign-up record and the coded Free Plan network values;
- users' sign-in accounts (name, email and sign-in factors), with their access to the company switched off. A user who no longer needs the account can ask us to delete it.
13.4. Deleted records remain in encrypted backups until those backups expire (section 12), and are not restored except to recover from a disaster.
14. Your rights
14.1. Under the Data Privacy Act you have the right to be informed, to access your personal information, to object to its processing (including automated decisions about you), to have it erased or blocked where the law allows, to correct it, to receive a copy in a portable form, and to claim damages. You may also file a complaint with the National Privacy Commission.
14.2. Employees: send requests about your payroll and timekeeping records to your employer, which decides on them as the controller. In the portal you can see your own records and payslips and ask for profile changes and time corrections. JTL helps your employer respond. If you write to us, we will pass your request to your employer and tell you that we did.
14.3. Visitors, people who used our forms, and account users: write to our Data Protection Officer (section 16). We aim to reply within 15 working days, and in any case within the period the National Privacy Commission's rules allow (currently 30 working days, which may be extended by 15 working days for complex or numerous requests, in which case we tell you why).
14.4. Some rights have limits. For example, payroll and tax records that the law requires your employer to keep cannot be erased before that period ends.
15. Personal data breaches
If a breach affects personal information in Sahora, we act under our breach management procedure. For records we hold for an employer, we tell the employer without undue delay so it can notify the National Privacy Commission and the people affected as the law requires. For records we control, we notify them ourselves when the law requires.
16. Contact and complaints
16.1. Data Protection Officer: write to mail@sahora.ph with "Data Protection Officer" in the subject, use the contact form at /contact, or write to the Data Protection Officer, JTL Advisory and Business Solutions Inc., Unit 3101-C East Tower, Tektite Twin Towers, Exchange Road, Ortigas Center, Pasig City 1600, Philippines.
16.2. You may also file a complaint with the National Privacy Commission (www.privacy.gov.ph).
17. Cookies and storage on your device
17.1. Sahora sets no cookies for signed-out visitors. When you sign in, Sahora uses only cookies that are strictly necessary: the sign-in session, an activity cookie that signs you out after a period without activity, and a cookie that limits how often your device is noted in your device list.
17.2. On your phone or computer, Sahora may keep: the random phone id for clock-ins; clock-ins waiting to be sent; payslip figures you chose to keep for offline reading (never the PDF); and small settings (such as a hidden install hint, a closed status notice, or a cookie choice). You can remove these by clearing the site's data in your browser.
17.3. Details are in the Cookie Notice (/legal/cookies).
18. Children
Sahora is not meant for children. People who manage a workspace, or work in one for an employer or accounting firm, must be at least 18 years old. When an employer employs a minor as the law allows, the employer is responsible for the notices it must give.
19. Changes to this notice
We will update this notice when our practices change. Each new version has a new date and version name. We tell users of a material change by email or in Sahora before it takes effect, and every user is asked to acknowledge the new version once at their next sign-in.